The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to define its testing scope and behavior, creating a vulnerability surface where malicious instructions could be embedded in data sources.
Ingestion points: In SKILL.md, Step 2 fetches data from issue trackers and commit messages. Step 3 involves interacting with a running application and reading a 'dogfood' workflow template.
Boundary markers: There are no specified delimiters or instructions for the agent to distinguish between data and instructions when reading commit messages or issue descriptions.
Capability inventory: The skill invokes other powerful tools (run and agent-browser) and executes shell commands to retrieve testing templates.
Sanitization: The instructions do not include steps to sanitize, escape, or validate the content retrieved from external issue trackers or the application's runtime state before the agent processes it.

browser-qa